Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/06/2026, 03:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AffinityLoader_patched.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
AffinityLoader_patched.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target AffinityLoader_patched.exe
- Size 1.9MB
- Sample260625-d2vxvahs8j
- SHA256 176c93b681c4d80e70eb1c5b190ae637b5ac44103359543e9133ad86c443df5b
- MD5 718aaf3ecc7859e46ddfb083a21f41f9
- SHA1 bc23e01f5e1c8bb2263e548c0b2ae344778ac5ba
- SHA512 bf56204f4b5669db3dbf7fcae18d1cd955cd7dc47d104647d2792dc99f1ba17de554f993c9d03d201fdab3315b4e83a5dd9a729eb3150007cb0ca9418c076a94
- SSDEEP 49152:nTcg01tiBBVvAid9WHUd3WnlTdNvR9uZ:s4Fd91g0Z
- TLSH T1E995AE47E2A901ECC567D278C612831BFB7138091B30A7DB26E54BA92F236E05F7E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 2360 AffinityLoader_patched.exe 2360 AffinityLoader_patched.exe 2360 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2360 AffinityLoader_patched.exe 2360 AffinityLoader_patched.exe 2360 AffinityLoader_patched.exe 2360 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 2360 AffinityLoader_patched.exe 2360 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 2360 AffinityLoader_patched.exe 2360 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 2360 AffinityLoader_patched.exe 2360 AffinityLoader_patched.exe 2360 AffinityLoader_patched.exe 2360 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 6040 AffinityLoader_patched.exe 5988 AffinityLoader_patched.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2360 wrote to memory of 5988 2360 AffinityLoader_patched.exe 89 PID 2360 wrote to memory of 6040 2360 AffinityLoader_patched.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\AffinityLoader_patched.exe"C:\Users\Admin\AppData\Local\Temp\AffinityLoader_patched.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\AffinityLoader_patched.exe"C:\Users\Admin\AppData\Local\Temp\AffinityLoader_patched.exe" --w7q4xt2 23602⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5988
-
-
C:\Users\Admin\AppData\Local\Temp\AffinityLoader_patched.exe"C:\Users\Admin\AppData\Local\Temp\AffinityLoader_patched.exe" --w7q4xt2 23602⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6040
-